Ashmem expected that it could always read ASHMEM_NAME_LEN bytes from the
provided pointer even if the actual string was shorter. This assumption
turns out to be false.
Bug: 409422661
Bug: 414339114
Change-Id: I7e070fc2b91f0483fd9372d52cfb4f0d6dcece48
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Given a pointer to a file structure that represents an ashmem region,
return the shmem vmfile that backs the region. This should only be
used for dumping information about ashmem regions in debug scenarios.
Bug: 193397560
Change-Id: I6ecd4ed0e02caac29a8bff9c52052066219a5a8c
Signed-off-by: Isaac J. Manjarres <isaacmanjarres@google.com>
Given a pointer to a file structure that represents an ashmem region,
return the size of the region. This should only be used for dumping
information about ashmem regions in debug scenarios.
Bug: 193397560
Change-Id: I24e6a2f7a469d667dc37ec8714e591b911043ee4
Signed-off-by: Isaac J. Manjarres <isaacmanjarres@google.com>
Given a pointer to a file structure that represents an ashmem region,
and a character array, populate the array with the name of the ashmem
region. This should only be used for dumping information about ashmem
regions in debug scenarios.
Bug: 193397560
Change-Id: Iafd000983eb4e2963a46163fa4b62eda07445e1e
Signed-off-by: Isaac J. Manjarres <isaacmanjarres@google.com>
The minidump module iterates over open files and VMAs for each process
and reports information that is useful for debugging. A useful piece of
information is what ashmem files are currently referenced either via
a userspace memory mapping or a file descriptor. Therefore, add
is_ashmem_file() to aid in identifying those references.
Unfortunately, the logic that exports Rust symbols to other kernel
modules only considers the crates under the rust/ directory at the root
of the kernel repository. Since there's no support to include symbols
from crates defined outside of that repository, add
ashmem_rust_exports.c to export is_ashmem_file().
Changes from older versions of this patch:
- Reworded commit message for clarity.
- Implemented is_ashmem_file() in Rust, since android16-6.12+ will use
Rust for ashmem.
Bug: 193397560
Change-Id: I5b7816ad4775e5cf2c4f41c28b1c8dacc2c85b7e
Signed-off-by: Isaac J. Manjarres <isaacmanjarres@google.com>
The application read the length of file and triggered a crash in android16-6.12. We found through analysis that FIONREAD should return ENOTTY, but EINVAL was returned in ashmem_rust.rs, which caused this issue. The default return is ENOTTY in ashmem.c.
The failed stacks is as follows:
07-03 10:47:51.830 13963 13963 D AndroidRuntime: Shutting down VM
07-03 10:47:51.834 13963 13963 E AndroidRuntime: FATAL EXCEPTION: main
07-03 10:47:51.834 13963 13963 E AndroidRuntime: Process: com.example.parceldemo:service, PID: 13963
07-03 10:47:51.834 13963 13963 E AndroidRuntime: java.lang.RuntimeException: Unable to start service com.example.parceldemo.services.ProcessService@b11ac4f with Intent { xflg=0x4 cmp=com.example.parceldemo/.services.ProcessService (has extras) }: java.io.IOException: Invalid argument
07-03 10:47:51.834 13963 13963 E AndroidRuntime: at android.app.ActivityThread.handleServiceArgs(ActivityThread.java:6099)
07-03 10:47:51.834 13963 13963 E AndroidRuntime: at android.app.ActivityThread.-$$Nest$mhandleServiceArgs(Unknown Source:0)
07-03 10:47:51.834 13963 13963 E AndroidRuntime: at android.app.ActivityThread$H.handleMessage(ActivityThread.java:3067)
07-03 10:47:51.834 13963 13963 E AndroidRuntime: at android.os.Handler.dispatchMessage(Handler.java:110)
07-03 10:47:51.834 13963 13963 E AndroidRuntime: at android.os.Looper.loopOnce(Looper.java:266)
07-03 10:47:51.834 13963 13963 E AndroidRuntime: at android.os.Looper.loop(Looper.java:361)
07-03 10:47:51.834 13963 13963 E AndroidRuntime: at android.app.ActivityThread.main(ActivityThread.java:10155)
07-03 10:47:51.834 13963 13963 E AndroidRuntime: at java.lang.reflect.Method.invoke(Native Method)
07-03 10:47:51.834 13963 13963 E AndroidRuntime: at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:638)
07-03 10:47:51.834 13963 13963 E AndroidRuntime: at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:1002)
07-03 10:47:51.834 13963 13963 E AndroidRuntime: Caused by: java.io.IOException: Invalid argument
07-03 10:47:51.834 13963 13963 E AndroidRuntime: at java.io.FileInputStream.available0(Native Method)
07-03 10:47:51.834 13963 13963 E AndroidRuntime: at java.io.FileInputStream.available(FileInputStream.java:523)
07-03 10:47:51.834 13963 13963 E AndroidRuntime: at kotlin.io.ByteStreamsKt.readBytes(IOStreams.kt:135)
07-03 10:47:51.834 13963 13963 E AndroidRuntime: at com.example.parceldemo.model.Book$Companion.from(Book.kt:25)
07-03 10:47:51.834 13963 13963 E AndroidRuntime: at com.example.parceldemo.services.ProcessService.onStartCommand(ProcessService.kt:37)
07-03 10:47:51.834 13963 13963 E AndroidRuntime: at android.app.ActivityThread.handleServiceArgs(ActivityThread.java:6081)
07-03 10:47:51.834 13963 13963 E AndroidRuntime: ... 9 more
The analysis process is as follows:
InputStream.readBytes(): ByteArray --> available() --> ioctl(fd, FIONREAD, &n)
--> ashmem_rust.rs fn ioctl(me: Pin<&Ashmem>, _file: &File, cmd: u32, arg: usize) -> Result<isize>
--> return Err(EINVAL)
/**
* Reads this stream completely into a byte array.
*
* **Note**: It is the caller's responsibility to close this stream.
*/
@SinceKotlin("1.3")
public fun InputStream.readBytes(): ByteArray {
val buffer = ByteArrayOutputStream(maxOf(DEFAULT_BUFFER_SIZE, this.available()))
copyTo(buffer)
return buffer.toByteArray()
}
libcore/ojluni/src/main/native/FileInputStream.c
128 static int available(int fd, jlong *bytes) {
129 // BEGIN Android-added: Fuchsia does not support FIONREAD. http://b/120566512
130 #if defined(__Fuchsia__)
131 *bytes = 0;
132 return 1;
133 #else
134 // END Android-added: Fuchsia does not support FIONREAD. http://b/120566512
135 int n;
136 // Unlike the original OpenJdk implementation, we use FIONREAD for all file
137 // types. For regular files, this is specified to return the difference
138 // between the current position and the file size. Note that this can be
139 // negative if we're positioned past the end of the file. We must return 0
140 // in that case.
141 if (ioctl(fd, FIONREAD, &n) != -1) {
142 if (n < 0) {
143 n = 0;
144 }
145 *bytes = n;
146 return 1;
147 }
148
149 // FIONREAD is specified to return ENOTTY when fd refers to a file
150 // type for which this ioctl isn't implemented.
151 if (errno == ENOTTY) {
152 *bytes = 0;
153 return 1;
154 }
155
156 // Raise an exception for all other error types.
157 return 0;
158 // Android-added: Fuchsia does not support the FIONREAD code. http://b/120566512
159 #endif
160 }
161
162 JNIEXPORT jint JNICALL
163 Java_java_io_FileInputStream_available0(JNIEnv *env, jobject this) {
164 jlong ret;
165 FD fd = getFD(env, this, fis_fd);
166 if (fd == -1) {
167 JNU_ThrowIOException (env, "Stream Closed");
168 return 0;
169 }
170 if (available(fd, &ret)) {
171 if (ret > INT_MAX) {
172 ret = (jlong) INT_MAX;
173 } else if (ret < 0) {
174 ret = 0;
175 }
176 return jlong_to_jint(ret);
177 }
178 JNU_ThrowIOExceptionWithLastError(env, NULL);
179 return 0;
180 }
common/drivers/staging/android/ashmem_rust.rs
245 fn ioctl(me: Pin<&Ashmem>, _file: &File, cmd: u32, arg: usize) -> Result<isize> {
246 let size = _IOC_SIZE(cmd);
247 match cmd {
248 bindings::ASHMEM_SET_NAME => me.set_name(UserSlice::new(arg, size).reader()),
249 bindings::ASHMEM_GET_NAME => me.get_name(UserSlice::new(arg, size).writer()),
250 bindings::ASHMEM_SET_SIZE => me.set_size(arg),
251 bindings::ASHMEM_GET_SIZE => me.get_size(),
252 bindings::ASHMEM_SET_PROT_MASK => me.set_prot_mask(arg),
253 bindings::ASHMEM_GET_PROT_MASK => me.get_prot_mask(),
254 bindings::ASHMEM_GET_FILE_ID => me.get_file_id(UserSlice::new(arg, size).writer()),
255 ASHMEM_PIN | ASHMEM_UNPIN | ASHMEM_GET_PIN_STATUS => {
256 me.pin_unpin(cmd, UserSlice::new(arg, size).reader())
257 }
258 bindings::ASHMEM_PURGE_ALL_CACHES => me.purge_all_caches(),
259 _ => Err(EINVAL),
260 }
261 }
common/drivers/staging/android/ashmem.c
828 static long ashmem_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
829 {
830 struct ashmem_area *asma = file->private_data;
831 unsigned long ino;
832 long ret = -ENOTTY;
-> For the c-version, it's ENOTTY
Bug: 430143362
Change-Id: Ie316e7f3670ecdf59b75ff127283a6744763361d
Signed-off-by: Justin Jiang <justinjiang@vivo.corp-partner.google.com>
We landed the MM series as FROMLIST, and in the version of the series
that landed upstream the VmAreaNew type had been renamed to VmaNew.
Thus, update the naming in Rust Binder.
Bug: 429146594
Change-Id: Iab7761c76a0cda1c231d28e24a5fec28134be16a
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
When calling a pin ioctl with an offset greater than the size of the
ashmem region, an integer underflow occurs. To fix that, return EINVAL
in this scenario.
Bug: 427377651
Change-Id: Ia85732374c2fa4155bcb4c347184e4c1d2bca965
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
When passing a very large size to __page_align, an integer overflow
happens. To make this unreachable, add a maximum size.
Bug: 426506201
Change-Id: I1139cc2b569df1187e7f55ded598bee192b2d6c9
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
In page-compat mode, all VMAs are forced to be a multiple of
the emulated page-size.
Bug: 414665621
Bug: 383389337
Change-Id: Idda8600616572f59a36c7150f412ec083010a8eb
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
In page-compat mode, all VMAs are forced to be a multiple of
the emulated page-size.
Bug: 383389337
Bug: 315325080
Bug: 302403436
Change-Id: I5c083cedc15c6837803efa497450c4df5331968f
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
Ashmem expected that it could always read ASHMEM_NAME_LEN bytes from the
provided pointer even if the actual string was shorter. This assumption
turns out to be false.
Bug: 409422661
Change-Id: I617be6c91947d44ec80b894c41fabe0f5c539eae
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
The current logic returns an error if the name of the buffer plus the
NUL terminating byte is exactly ASHMEM_NAME_LEN. This is incorrect, as
names are expected to have a maximum length of ASHMEM_NAME_LEN, which
accounts for the NUL terminating byte
Thus, change the error condition to be true if the length of the buffer
name plus the NUL terminating byte would be too big to fit in an
ASHMEM_NAME_LEN sized region.
Also, the buffer name is copied into indices [0 len - 1], so the NUL
terminating byte should be at index len, not len + 1.
Bug: 411723589
Change-Id: Ie8ecbad7b90848fea529ca7d043489edd952e333
Signed-off-by: Isaac J. Manjarres <isaacmanjarres@google.com>
As part of the LTS release, we are importing an improvement to Rust
integer types. This updates ashmem to use with the improved integer type
scheme.
Change-Id: If98954a2e9fcbb37a1f050f3e09a43d9268a8cc3
Fixes: e9cc806c01 ("Linux 6.12.19")
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
When backporting the Rust alloc and FFI integer changes, there is some
breakage in ashmem and related files due to API changes. Thus, update
these files to use the new API.
This should be applied at the same time as the merge of the stable
release containing this backport.
Link: https://lore.kernel.org/all/20250307225008.779961-1-ojeda@kernel.org/
Change-Id: I31aeaca89eb007302d1738e1be9d3789e92b404c
Fixes: 1ef4cf5f98 ("rust: alloc: update module comment of alloc.rs")
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
[Removed FFI integer changes because the stable backport does not yet
contain those. <mmaurer@google.com>]
Signed-off-by: Matthew Maurer <mmaurer@google.com>
When libcutils is configured to create memfds instead of ashmem fds, old
applications may still attempt to call ashmem ioctls on the fd. Thus,
add an ioctl handler to shmem to support the ioctls that are necessary.
We don't need to support the ioctls on hugeltb because libcutils does
not pass MFD_HUGETLB when creating the memfd.
Bug: 370906207
Change-Id: Ib56d55db0f590ee90b83a3e2cde67413fa8e10d6
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
The memfd type simulates SET_PROT_MASK using file seals, but there's no
file seal to prevent mapping executable memory. Thus, add a toggle that
removes the ability to unset the PROT_EXEC bit on an ashmem file.
Bug: 370906207
Change-Id: Ia90c2cfca689d152fb1765f2abcf6bb3f60cd05d
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
The memfd type simulates SET_PROT_MASK using file seals, but there's no
file seal to prevent mapping readable memory. Thus, add a toggle that
removes the ability to unset the PROT_READ bit on an ashmem file.
Bug: 370906207
Change-Id: I2d0347ce124d7d6d543cff765f77b28202cf327f
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Add basic functionality for toggling the behavior of the ashmem driver's
unpin call. Add a miscdevice that can be used to turn the shrinker on
and off.
Bug: 370906207
Change-Id: Ic0d1c596b7411dd338ad5c49b3d1ae9e50482c2d
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
There are tests in Android that perform feature detection by checking
whether CONFIG_ASHMEM=y is set in the config file. Thus, adjust the
Kconfig file so that CONFIG_ASHMEM=y determines whether either Ashmem
driver is available, and so that CONFIG_ASHMEM_RUST=y determines whether
the Rust driver is used or not.
This also avoids duplication of the help message for ashmem.
The CONFIG_ASHMEM_C boolean is introduced for use in the Makefile. It is
not possible to directly set this option as it has no description.
Bug: 398956719
Bug: 370906207
Change-Id: I2930eb8e02ef2ab61edde8f9b74083ec5abc3557
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
To support changing whether the shrinker is registered at runtime, move
it to a new global variable that will keep track of the current state.
The actual support for changing the state at runtime happens in a later
commit.
Bug: 370906207
Change-Id: Ic635c2cdfbe466f9a03583de881cbf63e39957df
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Add the simplest way of freeing pages that are unpinned: the
ASHMEM_PURGE_ALL_CACHES ioctl. It will free every single unpinned page.
Bug: 370906207
Change-Id: Ic1411148c036dec6528aa99f32d47a5b2e145c86
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Unlike the C driver, we do not need to release the lock when calling
`punch_hole`. This is because the global mutex is only held here and in
the PIN/UNPIN ioctl. That is to say, we never take the lock while
holding any fs locks anywhere, so calling into fs code with the lock
held is okay.
That said, not unlocking the mutex after each iteration means that the
shrinker will keep going even if there are PIN/UNPIN ioctls waiting for
the mutex, possibly for a long time. To avoid this, a counter is
introduced to have the shrinker exit early when a PIN/UNPIN ioctl starts
waiting for the mutex.
The lru_count field is moved to an atomic global so that `count_objects`
can read it without taking the lock. It's still only modified with the
lock held, so using load/store instead of an atomic increment will not
lead to race conditions.
This contains a vendored version of the shrinker abstractions [1].
Bug: 370906207
Change-Id: I7c181a9c6acd6278333f57feb72c8af7dce61049
Link: https://lore.kernel.org/all/20241014-shrinker-v2-1-04719efd2342@google.com/ [1]
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Keep track of the pages that are unpinned in a global list as well. This
will allow us to look up which pages can be freed when the system comes
under memory pressure.
Bug: 370906207
Change-Id: I8017e045127cbfa35e289f9d7f1f733121d74dd1
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Add the PIN/UNPIN ioctls that let the user pin and unpin pages in the
file. The ashmem file will store information about which pages are
unpinned in a linked list of ranges.
Instead of using the mutex of the ashmem file, the ranges are protected
by a new global mutex. This mutex will allow us to store all of the
ranges in a global LRU list.
The ranges are sorted in descending order to match ashmem.
Bug: 370906207
Change-Id: I01ffdf63dc8bbfcc64ccb01200a9f3c5cd2cdcbe
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
These utilities let you get debug information about an ashmem file.
Bug: 370906207
Change-Id: I5b9d00650272b3b814eb9e37a3b38123331f7624
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Similarly to reading, we also forward seeking to the underlying file.
Bug: 370906207
Change-Id: Icba9b7416276211c71ca04b266d12523389ad733
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
We just forward read calls to the underlying shmem file.
Bug: 370906207
Change-Id: I14da5e4312c9c2807861c68f6cae0fa76a45f885
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
The new `shmem.rs` file is a Rust abstraction around shmem files. It's
important that we modify the fops to prevent users from calling mmap
again, as they could otherwise modify the protection bits on the memory
region in a way that bypasses the ashmem protection mask.
Bug: 370906207
Change-Id: I0d2f4b56ac005d131a6ef0f9c7b346549effd1d7
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
On 32-bit systems, some of the ioctls are slightly different.
Bug: 370906207
Change-Id: Ibff577177a2e12f63156a99e5ffeeb8392ded4c2
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
It's really important for ashmem's security model that once you give up
protection bits, you can't get them back. Another important factor is
that this will not affect existing mmaps. This means that if you mmap a
writable ashmem fd, and then give up all of your permissions, then even
if you accidentally send the fd to another process, that other process
will not be able to access the contents.
The mman.h header is for the PROT_* constants.
Bug: 370906207
Change-Id: I5046126ffd1c2ac99936eaeaee89087961092649
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Add the second ioctl. Once we add `mmap`, we must add a check that the
size does not change after `mmap` is called.
Bug: 370906207
Change-Id: Ib6e4f8e256491aa2d2974e805b2e5d98eba1e445
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Add the first ioctl to the ashmem device. The `Ashmem` struct is
augmented with a mutex to hold the name.
The Rust bindings helper is updated to pull in constants from the
existing C header. For now, only ASHMEM_NAME_LEN is needed, but later
patches will need more stuff from the C header.
Bug: 370906207
Change-Id: I7fbbce12e1fa7c4fb811fcb2561806795ba2bd0f
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
For now, we just register a miscdevice with no operations defined on it.
Bug: 370906207
Change-Id: I9ea307095ffd66859239ec4926523222466d3602
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
To make the ioctl constants available from Rust, use a enum rather than
using #define. This is analogous to a similar change for Binder [1].
Also move some constants from ashmem.c to ashmem.h so that Rust ashmem
can use them too.
Bug: 370906207
Link: https://lore.kernel.org/all/20231208152801.3425772-1-aliceryhl@google.com/ [1]
Change-Id: I14032b0d0522eb961d41d3cd097d352d7fd10f75
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Upstream commit 529ce23a76 ("mm: switch mm->get_unmapped_area() to a
flag") introduced mm_get_unmapped_area() helper, to be used instead of
mm->get_unmapped_area function pointer.
Fixes: 529ce23a76 ("mm: switch mm->get_unmapped_area() to a flag")
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Change-Id: I71e315f3cf0691da6ac708bcc9dceb4549098610
Old APIs are removed since the upstream commit
f2383e0150 ("mm: shrinker: remove old APIs").
So use the new APIs to dynamically allocate the
android-ashmem shrinker.
Bug: 146449535
Change-Id: I1100b9eb66886c3350c780a759f66f6a3807d52f
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Commit 1c71222e5f ("mm: replace vma->vm_flags direct modifications
with modifier calls") removed the ability to directly access vm_flags, but
provided wrapper functions to do the task instead. Use vm_flags_clear()
to fix the build breakage in the ashmem code because of this change.
Fixes: 1c71222e5f ("mm: replace vma->vm_flags direct modifications with modifier calls")
Cc: Suren Baghdasaryan <surenb@google.com>
Change-Id: I865469c1eacd8d037eaaa85eca65e54f717e8706
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
This will allow a client program to avoid redundant actions on ashmem
buffers which it has already seen.
Bug: 244233389
Change-Id: Ica57a8842ff163eae5f9eca8141b439091ec0940
Signed-off-by: Mark Fasheh <mfasheh@google.com>
Upstream mandates registering shrinkers with a name now.
Fixes: e33c267ab7 ("mm: shrinkers: provide shrinkers with names")
Change-Id: I434150d024e976fc3facfc4b34a2199a9c2e5d08
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
In commit 1045a06724 ("remove CONFIG_ANDROID"), CONFIG_ANDROID is
removed, so fix up the CONFIG_ASHMEM build option to not require it to
be selected and built properly.
Fixes: 1045a06724 ("remove CONFIG_ANDROID")
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: If9cdf1350949cf98444c20d778d1ca1228a6cd6d
In preparation to limit the scope of a list iterator to the list
traversal loop, use a dedicated pointer to point to the found element
[1].
Before, the code implicitly used the head when no element was found
when using &pos->list. Since the new variable is only set if an
element was found, the head needs to be used explicitly if the
variable is NULL.
Link: https://lore.kernel.org/all/CAHk-=wgRr_D8CB-D9Kg-c=EHreAsk5SqXPwr9Y7k9sA6cWXJ6w@mail.gmail.com/ [1]
Signed-off-by: Jakob Koschel <jakobkoschel@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ifaf19dd876a513a1952fac448079d664aebdf604
This reverts commit 721412ed3d.
Android just isn't ready yet to give it up :(
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ie0a443d55e6e72df97c3d3eabb7358ae3a12548a
Pull more drm updates from Daniel Vetter:
"UAPI Changes:
- Only enable char/agp uapi when CONFIG_DRM_LEGACY is set
Cross-subsystem Changes:
- vma_set_file helper to make vma->vm_file changing less brittle,
acked by Andrew
Core Changes:
- dma-buf heaps improvements
- pass full atomic modeset state to driver callbacks
- shmem helpers: cached bo by default
- cleanups for fbdev, fb-helpers
- better docs for drm modes and SCALING_FITLER uapi
- ttm: fix dma32 page pool regression
Driver Changes:
- multi-hop regression fixes for amdgpu, radeon, nouveau
- lots of small amdgpu hw enabling fixes (display, pm, ...)
- fixes for imx, mcde, meson, some panels, virtio, qxl, i915, all
fairly minor
- some cleanups for legacy drm/fbdev drivers"
* tag 'drm-next-2020-12-18' of git://anongit.freedesktop.org/drm/drm: (117 commits)
drm/qxl: don't allocate a dma_address array
drm/nouveau: fix multihop when move doesn't work.
drm/i915/tgl: Fix REVID macros for TGL to fetch correct stepping
drm/i915: Fix mismatch between misplaced vma check and vma insert
drm/i915/perf: also include Gen11 in OATAILPTR workaround
Revert "drm/i915: re-order if/else ladder for hpd_irq_setup"
drm/amdgpu/disply: fix documentation warnings in display manager
drm/amdgpu: print mmhub client name for dimgrey_cavefish
drm/amdgpu: set mode1 reset as default for dimgrey_cavefish
drm/amd/display: Add get_dig_frontend implementation for DCEx
drm/radeon: remove h from printk format specifier
drm/amdgpu: remove h from printk format specifier
drm/amdgpu: Fix spelling mistake "Heterogenous" -> "Heterogeneous"
drm/amdgpu: fix regression in vbios reservation handling on headless
drm/amdgpu/SRIOV: Extend VF reset request wait period
drm/amdkfd: correct amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu log.
drm/amd/display: Adding prototype for dccg21_update_dpp_dto()
drm/amdgpu: print what method we are using for runtime pm
drm/amdgpu: simplify logic in atpx resume handling
drm/amdgpu: no need to call pci_ignore_hotplug for _PR3
...
Alice Ryhl
Isaac J. Manjarres
Justin Jiang
Kalesh Singh
Amit Pundir
Greg Kroah-Hartman
Mark Fasheh
Jakob Koschel
Christoph Hellwig
liuhailong
Lee Jones
George Xanthakis
Zhaoyang Huang
Linus Torvalds